Technical Information
To ensure autorun and distribution
Sets the following service settings
- [HKLM\System\CurrentControlSet\Services\Program Device Disk Protected] 'Start' = '00000002'
- [HKLM\System\CurrentControlSet\Services\Program Device Disk Protected] 'ImagePath' = 'C:\amjanjemflcew\ujbfakj.exe'
Creates the following services
- 'Program Device Disk Protected' C:\amjanjemflcew\ujbfakj.exe
Modifies file system
Creates the following files
- %WINDIR%\amjanjemflcew\y1bp9w
- C:\amjanjemflcew\y1bp9w
- C:\amjanjemflcew\xpg5e4zkodd6tlm.exe
- C:\amjanjemflcew\ujbfakj.exe
- C:\amjanjemflcew\khckctgngfrq.exe
Sets the 'hidden' attribute to the following files
- C:\amjanjemflcew\ujbfakj.exe
- C:\amjanjemflcew\khckctgngfrq.exe
Deletes the following files
- %WINDIR%\amjanjemflcew\y1bp9w
- C:\amjanjemflcew\xpg5e4zkodd6tlm.exe
Substitutes the following files
- %WINDIR%\amjanjemflcew\y1bp9w
Network activity
Connects to
- 'ch####tation.net':80
- 'fo####station.net':80
- 'jo####yspace.net':80
- 'li###espace.net':80
- 'be####travel.net':80
TCP
HTTP GET requests
- http://ch####tation.net/index.php
- http://fo####station.net/index.php
- http://jo####yspace.net/index.php
- http://li###espace.net/index.php
- http://be####travel.net/index.php
UDP
- DNS ASK wi####listen.net
- DNS ASK hu####dtravel.net
- DNS ASK jo####ytravel.net
- DNS ASK hu####dspace.net
- DNS ASK jo####yspace.net
- DNS ASK re#####rchildhood.net
- DNS ASK wo####hildhood.net
- DNS ASK re####erobject.net
- DNS ASK wo###object.net
- DNS ASK re####erthird.net
- DNS ASK wo###third.net
- DNS ASK re####erstation.net
- DNS ASK wo####tation.net
- DNS ASK in#####echildhood.net
- DNS ASK fo####childhood.net
- DNS ASK fo####object.net
- DNS ASK hu####dyellow.net
- DNS ASK in####sethird.net
- DNS ASK fo###tthird.net
- DNS ASK in####sestation.net
- DNS ASK fo####station.net
- DNS ASK th#####childhood.net
- DNS ASK ef####childhood.net
- DNS ASK th####hobject.net
- DNS ASK ef####object.net
- DNS ASK th####hthird.net
- DNS ASK ef###tthird.net
- DNS ASK th####hstation.net
- DNS ASK ef####station.net
- DNS ASK su####childhood.net
- DNS ASK in####seobject.net
- DNS ASK be###gthird.net
- DNS ASK jo####yclose.net
- DNS ASK su####yellow.net
- DNS ASK wi####yellow.net
- DNS ASK su####travel.net
- DNS ASK wi####travel.net
- DNS ASK su###rspace.net
- DNS ASK wi###nspace.net
- DNS ASK th###close.net
- DNS ASK ch###close.net
- DNS ASK th###yellow.net
- DNS ASK ch###yellow.net
- DNS ASK th###travel.net
- DNS ASK ch###travel.net
- DNS ASK th###space.net
- DNS ASK ch###space.net
- DNS ASK wi####childhood.net
- DNS ASK jo####yyellow.net
- DNS ASK be####yellow.net
- DNS ASK ri####yellow.net
- DNS ASK be####travel.net
- DNS ASK ri####travel.net
- DNS ASK be###gspace.net
- DNS ASK ri###nspace.net
- DNS ASK li###eclose.net
- DNS ASK de####yclose.net
- DNS ASK li####yellow.net
- DNS ASK de####yyellow.net
- DNS ASK li####travel.net
- DNS ASK de####ytravel.net
- DNS ASK li###espace.net
- DNS ASK de####yspace.net
- DNS ASK ri###nclose.net
- DNS ASK hu####dclose.net
- DNS ASK su####object.net
- DNS ASK wi####object.net
- DNS ASK su###rthird.net
- DNS ASK in####sebring.net
- DNS ASK re####ershout.net
- DNS ASK wo###shout.net
- DNS ASK re####erdemand.net
- DNS ASK wo###demand.net
- DNS ASK re####erlisten.net
- DNS ASK wo###listen.net
- DNS ASK re####erbring.net
- DNS ASK wo###bring.net
- DNS ASK in####seshout.net
- DNS ASK fo###tshout.net
- DNS ASK in####sedemand.net
- DNS ASK fo####demand.net
- DNS ASK in####selisten.net
- DNS ASK wi###nclose.net
- DNS ASK hu####dstation.net
- DNS ASK fo###tbring.net
- DNS ASK th####hshout.net
- DNS ASK ef###tshout.net
- DNS ASK th####hdemand.net
- DNS ASK ef####demand.net
- DNS ASK th####hlisten.net
- DNS ASK ef####listen.net
- DNS ASK th####hbring.net
- DNS ASK ef###tbring.net
- DNS ASK su###rshout.net
- DNS ASK wi###nshout.net
- DNS ASK su####demand.net
- DNS ASK wi####demand.net
- DNS ASK su####listen.net
- DNS ASK fo####listen.net
- DNS ASK be###gclose.net
- DNS ASK jo####ythird.net
- DNS ASK hu####dobject.net
- DNS ASK hu####dthird.net
- DNS ASK wi###nthird.net
- DNS ASK su####station.net
- DNS ASK wi####station.net
- DNS ASK th####hildhood.net
- DNS ASK ch####hildhood.net
- DNS ASK th###object.net
- DNS ASK ch###object.net
- DNS ASK th###third.net
- DNS ASK ch###third.net
- DNS ASK th####tation.net
- DNS ASK ch####tation.net
- DNS ASK be####childhood.net
- DNS ASK ri####childhood.net
- DNS ASK jo####yobject.net
- DNS ASK be####object.net
- DNS ASK jo####ystation.net
- DNS ASK ri###nthird.net
- DNS ASK be####station.net
- DNS ASK ri####station.net
- DNS ASK li####childhood.net
- DNS ASK de#####childhood.net
- DNS ASK li####object.net
- DNS ASK de####yobject.net
- DNS ASK li###ethird.net
- DNS ASK de####ythird.net
- DNS ASK li####station.net
- DNS ASK de####ystation.net
- DNS ASK hu#####childhood.net
- DNS ASK jo#####childhood.net
- DNS ASK ri####object.net
- DNS ASK su###rclose.net
Miscellaneous
Creates and executes the following
- 'C:\amjanjemflcew\xpg5e4zkodd6tlm.exe'
- 'C:\amjanjemflcew\ujbfakj.exe'
- 'C:\amjanjemflcew\khckctgngfrq.exe' "c:\amjanjemflcew\ujbfakj.exe"
